IBX-12042: Deprecated filename-less download route in favor of filename-validated variant

[wiewiurdp]

🎫 Issue	IBX-12042

Description:

The ibexa.content.download.field_id route accepts plain integer parameters only, which allows enumerating and mass-downloading all accessible files with a simple loop over contentId × fieldId (see IBX-11681, where filename validation was added to the main download route — this route bypassed it).

Changes:

• Added a new ibexa.content.download.field_id.filename route (/content/download/{contentId}/{fieldId}/{filename}), which validates the filename against the field value and returns 404 on mismatch. It is defined before ibexa.content.download so that a numeric {fieldId} takes precedence over {fieldIdentifier}.
• ContentDownloadUrlGenerator now generates the new route, so all field value URLs (uri in PHP API and REST) include the filename.
• Deprecated the filename-less route: requests without a filename still work but trigger a deprecation. To be removed in 6.0.
• Deprecated the unused DownloadRedirectionController (no route has referenced it since the GHSA-g95c-xc83-8353 fix).

[konradoboza]

Apart from one comment and Andrew's remarks.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[bnowak]

👌